managed-deepagents 0.5.3-dev.111 → 0.5.3-dev.113

package/dist/identity/oauth-tickets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-tickets.d.ts","sourceRoot":"","sources":["../../src/identity/oauth-tickets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAsBH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB7B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB7B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,WAAW,CACT,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,WAAW,CACT,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/B,YAAY,CACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,YAAY,CACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAgBhE"}

package/dist/identity/oauth-tickets.js

@@ -1,114 +0,0 @@
-/**
- * Shared OAuth state and connect-ticket JWTs for Connect-with-X providers.
- *
- * Parameterized by provider id so each integration gets distinct `typ` values
- * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`) without copying JWT code.
- */
-import { randomBytes } from "node:crypto";
-import { jwtVerify, SignJWT } from "jose";
-const STATE_TTL_MS = 10 * 60 * 1000;
-/** Short-lived ticket so Slack/email actors can open Connect without a browser session. */
-const CONNECT_TICKET_TTL_MS = 30 * 60 * 1000;
-function stateTyp(providerId) {
-    return `mda-${providerId}-oauth-state`;
-}
-function ticketTyp(providerId) {
-    return `mda-${providerId}-connect-ticket`;
-}
-function stateSigningKey(signingKey) {
-    return new TextEncoder().encode(signingKey);
-}
-export async function createOauthState(providerId, userId, signingKey, nowMs = Date.now()) {
-    const iat = Math.floor(nowMs / 1000);
-    const exp = Math.floor((nowMs + STATE_TTL_MS) / 1000);
-    return new SignJWT({
-        userId,
-        nonce: randomBytes(16).toString("hex"),
-    })
-        .setProtectedHeader({ alg: "HS256", typ: stateTyp(providerId) })
-        .setIssuedAt(iat)
-        .setExpirationTime(exp)
-        .sign(stateSigningKey(signingKey));
-}
-export async function verifyOauthState(providerId, state, signingKey, nowMs = Date.now()) {
-    try {
-        const { payload } = await jwtVerify(state, stateSigningKey(signingKey), {
-            algorithms: ["HS256"],
-            typ: stateTyp(providerId),
-            currentDate: new Date(nowMs),
-        });
-        if (typeof payload.userId !== "string" || !payload.userId) {
-            throw new Error("invalid OAuth state actor");
-        }
-        return { userId: payload.userId };
-    }
-    catch (err) {
-        if (err instanceof Error && err.message.startsWith("invalid OAuth state")) {
-            throw err;
-        }
-        const message = err instanceof Error ? err.message : String(err);
-        if (/exp|expir/i.test(message)) {
-            throw new Error("OAuth state expired");
-        }
-        throw new Error("invalid OAuth state signature");
-    }
-}
-/**
- * Mint a short-lived connect ticket for channel actors (Slack, etc.) who have
- * no browser session. The Connect start route accepts `?ticket=…` and binds
- * the OAuth vault subject to this user id.
- */
-export async function createConnectTicket(providerId, userId, signingKey, nowMs = Date.now()) {
-    const iat = Math.floor(nowMs / 1000);
-    const exp = Math.floor((nowMs + CONNECT_TICKET_TTL_MS) / 1000);
-    return new SignJWT({
-        userId,
-        nonce: randomBytes(16).toString("hex"),
-    })
-        .setProtectedHeader({ alg: "HS256", typ: ticketTyp(providerId) })
-        .setIssuedAt(iat)
-        .setExpirationTime(exp)
-        .sign(stateSigningKey(signingKey));
-}
-export async function verifyConnectTicket(providerId, ticket, signingKey, nowMs = Date.now()) {
-    try {
-        const { payload } = await jwtVerify(ticket, stateSigningKey(signingKey), {
-            algorithms: ["HS256"],
-            typ: ticketTyp(providerId),
-            currentDate: new Date(nowMs),
-        });
-        if (typeof payload.userId !== "string" || !payload.userId) {
-            throw new Error("invalid connect ticket actor");
-        }
-        return { userId: payload.userId };
-    }
-    catch (err) {
-        if (err instanceof Error &&
-            err.message.startsWith("invalid connect ticket")) {
-            throw err;
-        }
-        const message = err instanceof Error ? err.message : String(err);
-        if (/exp|expir/i.test(message)) {
-            throw new Error("connect ticket expired");
-        }
-        throw new Error("invalid connect ticket signature");
-    }
-}
-/**
- * Bind {@link createOauthState} / ticket helpers to a Connect provider id
- * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`).
- */
-export function oauthTicketsFor(providerId) {
-    const id = providerId.trim();
-    if (!id) {
-        throw new Error("oauthTicketsFor requires a non-empty providerId");
-    }
-    return {
-        providerId: id,
-        createState: (userId, signingKey, nowMs) => createOauthState(id, userId, signingKey, nowMs),
-        verifyState: (state, signingKey, nowMs) => verifyOauthState(id, state, signingKey, nowMs),
-        createTicket: (userId, signingKey, nowMs) => createConnectTicket(id, userId, signingKey, nowMs),
-        verifyTicket: (ticket, signingKey, nowMs) => verifyConnectTicket(id, ticket, signingKey, nowMs),
-    };
-}
-//# sourceMappingURL=oauth-tickets.js.map

package/dist/identity/oauth-tickets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-tickets.js","sourceRoot":"","sources":["../../src/identity/oauth-tickets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,2FAA2F;AAC3F,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO,OAAO,UAAU,cAAc,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,OAAO,OAAO,UAAU,iBAAiB,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC;QACjB,MAAM;QACN,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;SAC/D,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,KAAa,EACb,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE;YACtE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC;YACzB,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/D,OAAO,IAAI,OAAO,CAAC;QACjB,MAAM;QACN,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;SAChE,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE;YACvE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC;YAC1B,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAChD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AA2BD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CACzC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QACjD,WAAW,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CACxC,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;QAChD,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAC1C,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QACpD,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAC1C,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/identity/slack/connect-http.d.ts

@@ -1,35 +0,0 @@
-/**
- * Connect-with-Slack — {@link IdentityConnectProvider} for Slack OIDC linking.
- *
- * Mounted under `/identity/slack/*` when listed on `identity.connect`, or when
- * a Slack channel routes into a user-scoped / custom-credentials deployment
- * (so Events can remap actors and tools can use per-caller tokens).
- */
-import type { IdentityConnectProvider } from "../connect-provider-types.js";
-import { type IdentityLinkStore } from "./links.js";
-export declare const SLACK_CONNECT_STATUS_PATH: string;
-export declare const SLACK_CONNECT_START_PATH: string;
-export declare const SLACK_CONNECT_CALLBACK_PATH: string;
-export declare const SLACK_CONNECT_LINK_PATH: string;
-/** Options for {@link createSlackIdentityConnectProvider}. */
-export interface SlackIdentityConnectProviderOptions {
-    linkStore?: IdentityLinkStore;
-}
-/** Build a Slack connect provider (injectable store for tests). */
-export declare function createSlackIdentityConnectProvider(options?: SlackIdentityConnectProviderOptions): IdentityConnectProvider;
-/** Default Slack connect provider used by the identity-connect registry. */
-export declare const slackIdentityConnectProvider: IdentityConnectProvider;
-/**
- * Opt into Connect-with-Slack on `defineIdentity({ connect: […] })`.
- *
- * @example
- * ```ts
- * import { connect, defineIdentity } from "managed-deepagents";
- *
- * export const identity = defineIdentity({
- *   connect: [connect.slack()],
- * });
- * ```
- */
-export declare function connect(options?: SlackIdentityConnectProviderOptions): IdentityConnectProvider;
-//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/slack/connect-http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAmBpB,eAAO,MAAM,yBAAyB,QAAe,CAAC;AACtD,eAAO,MAAM,wBAAwB,QAAgB,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,8DAA8D;AAC9D,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,mEAAmE;AACnE,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,mCAAwC,GAChD,uBAAuB,CA6FzB;AAED,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,EAAE,uBACL,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,mCAAmC,GAC5C,uBAAuB,CAIzB"}

package/dist/identity/slack/connect-http.js

@@ -1,115 +0,0 @@
-/**
- * Connect-with-Slack — {@link IdentityConnectProvider} for Slack OIDC linking.
- *
- * Mounted under `/identity/slack/*` when listed on `identity.connect`, or when
- * a Slack channel routes into a user-scoped / custom-credentials deployment
- * (so Events can remap actors and tools can use per-caller tokens).
- */
-import { buildIdentityLinkRecord, getIdentityLinkStore, } from "./links.js";
-import { buildSlackAuthorizeUrl, exchangeSlackOidcCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, readSlackOidcConfig, resolveOauthRedirectBase, slackOauthTickets, } from "./oauth.js";
-import { identityConnectPaths } from "../connect-paths.js";
-import { hasChannelForProvider, isUserScopedDeployment, } from "../connect-inference.js";
-const PATHS = identityConnectPaths("slack");
-export const SLACK_CONNECT_STATUS_PATH = PATHS.status;
-export const SLACK_CONNECT_START_PATH = PATHS.connect;
-export const SLACK_CONNECT_CALLBACK_PATH = PATHS.callback;
-export const SLACK_CONNECT_LINK_PATH = PATHS.link;
-/** Build a Slack connect provider (injectable store for tests). */
-export function createSlackIdentityConnectProvider(options = {}) {
-    const store = () => options.linkStore ?? getIdentityLinkStore();
-    return {
-        id: "slack",
-        shouldMount(ctx) {
-            if (!ctx.hasIdentity) {
-                return false;
-            }
-            // Listed on `identity.connect` — the author already opted in. Otherwise
-            // mount only when a Slack channel routes into a per-user deployment,
-            // which is exactly when there is a Slack account worth linking.
-            return (ctx.declared !== false ||
-                (hasChannelForProvider(ctx.channels, "slack") &&
-                    isUserScopedDeployment(ctx.scope)));
-        },
-        async status(userId) {
-            const link = await store().getByUserId(userId);
-            return {
-                linked: Boolean(link),
-                ...(link
-                    ? {
-                        slackUserId: link.slackUserId,
-                        slackKey: link.slackKey,
-                        linkedAt: link.linkedAt,
-                    }
-                    : {}),
-            };
-        },
-        async startAuthorize(userId, redirectUri) {
-            const oauth = readSlackOidcConfig();
-            const stateKey = readOauthStateSigningKey();
-            if (!oauth || !stateKey) {
-                return {
-                    notConfigured: true,
-                    error: `Slack connect is not configured (set SLACK_CLIENT_ID, SLACK_CLIENT_SECRET, MDA_PUBLIC_APP_URL, ${OAUTH_STATE_SIGNING_KEY_ENV})`,
-                };
-            }
-            const state = await slackOauthTickets.createState(userId, stateKey);
-            return {
-                authorizeUrl: buildSlackAuthorizeUrl(oauth, state, redirectUri),
-            };
-        },
-        async completeCallback(code, state, redirectUri) {
-            const oauth = readSlackOidcConfig();
-            if (!oauth) {
-                throw new Error("Slack OAuth is not configured");
-            }
-            const stateKey = readOauthStateSigningKey();
-            if (!stateKey) {
-                throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
-            }
-            const { userId } = await slackOauthTickets.verifyState(state, stateKey);
-            const slackIdentity = await exchangeSlackOidcCode(oauth, code, redirectUri);
-            const teamId = slackIdentity.teamId ?? oauth.teamId;
-            const record = buildIdentityLinkRecord({
-                userId,
-                slackUserId: slackIdentity.userId,
-                ...(teamId ? { slackTeamId: teamId } : {}),
-                ...(slackIdentity.email ? { email: slackIdentity.email } : {}),
-            });
-            await store().upsert(record);
-            return {
-                successRedirect: `${oauth.publicAppUrl}/settings?slack=connected`,
-            };
-        },
-        async unlink(userId) {
-            await store().removeByUserId(userId);
-        },
-        resolveRedirectBase(options) {
-            return resolveOauthRedirectBase(options);
-        },
-        resolvePublicAppUrl() {
-            const oauth = readSlackOidcConfig();
-            return (oauth?.publicAppUrl ??
-                process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, ""));
-        },
-    };
-}
-/** Default Slack connect provider used by the identity-connect registry. */
-export const slackIdentityConnectProvider = createSlackIdentityConnectProvider();
-/**
- * Opt into Connect-with-Slack on `defineIdentity({ connect: […] })`.
- *
- * @example
- * ```ts
- * import { connect, defineIdentity } from "managed-deepagents";
- *
- * export const identity = defineIdentity({
- *   connect: [connect.slack()],
- * });
- * ```
- */
-export function connect(options) {
-    return options
-        ? createSlackIdentityConnectProvider(options)
-        : slackIdentityConnectProvider;
-}
-//# sourceMappingURL=connect-http.js.map

package/dist/identity/slack/connect-http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOlD,mEAAmE;AACnE,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAwC,EAAE;IAEjD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;oBAC3C,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kGAAkG,2BAA2B,GAAG;iBACxI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO;gBACL,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,EACL,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM;gBACN,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,2BAA2B;aAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,EAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA6C;IAE7C,OAAO,OAAO;QACZ,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,4BAA4B,CAAC;AACnC,CAAC"}

package/dist/identity/slack/index.d.ts

@@ -1,8 +0,0 @@
-/**
- * Slack identity helpers — Connect-with-Slack opt-in for `defineIdentity`.
- *
- * Slack Events / messaging authoring lives on `connectors.slack`.
- */
-export { connect, createSlackIdentityConnectProvider, slackIdentityConnectProvider, SLACK_CONNECT_CALLBACK_PATH, SLACK_CONNECT_LINK_PATH, SLACK_CONNECT_START_PATH, SLACK_CONNECT_STATUS_PATH, } from "./connect-http.js";
-export type { SlackIdentityConnectProviderOptions } from "./connect-http.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/identity/slack/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,OAAO,EACP,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/identity/slack/index.js

@@ -1,7 +0,0 @@
-/**
- * Slack identity helpers — Connect-with-Slack opt-in for `defineIdentity`.
- *
- * Slack Events / messaging authoring lives on `connectors.slack`.
- */
-export { connect, createSlackIdentityConnectProvider, slackIdentityConnectProvider, SLACK_CONNECT_CALLBACK_PATH, SLACK_CONNECT_LINK_PATH, SLACK_CONNECT_START_PATH, SLACK_CONNECT_STATUS_PATH, } from "./connect-http.js";
-//# sourceMappingURL=index.js.map

package/dist/identity/slack/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/slack/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,OAAO,EACP,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC"}

package/dist/identity/slack/oauth.d.ts

@@ -1,28 +0,0 @@
-/**
- * Slack OpenID Connect helpers for Connect-with-Slack account linking.
- */
-export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "../oauth-env.js";
-export declare const SLACK_CLIENT_ID_ENV = "SLACK_CLIENT_ID";
-export declare const SLACK_CLIENT_SECRET_ENV = "SLACK_CLIENT_SECRET";
-export declare const SLACK_TEAM_ID_ENV = "SLACK_TEAM_ID";
-/** Override Slack OIDC base (tests). */
-export declare const SLACK_OIDC_BASE_ENV = "SLACK_OIDC_BASE";
-/** Slack-bound OAuth state / connect-ticket helpers. */
-export declare const slackOauthTickets: import("../oauth-tickets.js").OauthTickets;
-export interface SlackOidcConfig {
-    clientId: string;
-    clientSecret: string;
-    teamId?: string;
-    publicAppUrl: string;
-    oidcBase: string;
-}
-export interface SlackOidcIdentity {
-    userId: string;
-    teamId?: string;
-    email?: string;
-}
-export declare function readSlackOidcConfig(env?: NodeJS.ProcessEnv): SlackOidcConfig | null;
-export declare function slackConnectUrl(publicAppUrl: string): string;
-export declare function buildSlackAuthorizeUrl(config: SlackOidcConfig, state: string, redirectUri: string): string;
-export declare function exchangeSlackOidcCode(config: SlackOidcConfig, code: string, redirectUri: string): Promise<SlackOidcIdentity>;
-//# sourceMappingURL=oauth.d.ts.map

package/dist/identity/slack/oauth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,wCAAwC;AACxC,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAIrD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,4CAA2B,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,GAAG,IAAI,CAmBxB;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAWR;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CA4D5B"}

package/dist/identity/slack/oauth.js

@@ -1,87 +0,0 @@
-/**
- * Slack OpenID Connect helpers for Connect-with-Slack account linking.
- */
-import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS, } from "../../runtime/http.js";
-import { oauthTicketsFor } from "../oauth-tickets.js";
-import { MDA_PUBLIC_APP_URL_ENV } from "../oauth-env.js";
-export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "../oauth-env.js";
-export const SLACK_CLIENT_ID_ENV = "SLACK_CLIENT_ID";
-export const SLACK_CLIENT_SECRET_ENV = "SLACK_CLIENT_SECRET";
-export const SLACK_TEAM_ID_ENV = "SLACK_TEAM_ID";
-/** Override Slack OIDC base (tests). */
-export const SLACK_OIDC_BASE_ENV = "SLACK_OIDC_BASE";
-const DEFAULT_OIDC_BASE = "https://slack.com";
-/** Slack-bound OAuth state / connect-ticket helpers. */
-export const slackOauthTickets = oauthTicketsFor("slack");
-export function readSlackOidcConfig(env = process.env) {
-    const clientId = env[SLACK_CLIENT_ID_ENV]?.trim();
-    const clientSecret = env[SLACK_CLIENT_SECRET_ENV]?.trim();
-    const publicAppUrl = env[MDA_PUBLIC_APP_URL_ENV]?.trim();
-    if (!clientId || !clientSecret || !publicAppUrl) {
-        return null;
-    }
-    return {
-        clientId,
-        clientSecret,
-        ...(env[SLACK_TEAM_ID_ENV]?.trim()
-            ? { teamId: env[SLACK_TEAM_ID_ENV].trim() }
-            : {}),
-        publicAppUrl: publicAppUrl.replace(/\/$/, ""),
-        oidcBase: (env[SLACK_OIDC_BASE_ENV]?.trim() || DEFAULT_OIDC_BASE).replace(/\/$/, ""),
-    };
-}
-export function slackConnectUrl(publicAppUrl) {
-    return `${publicAppUrl.replace(/\/$/, "")}/settings`;
-}
-export function buildSlackAuthorizeUrl(config, state, redirectUri) {
-    const url = new URL(`${config.oidcBase}/openid/connect/authorize`);
-    url.searchParams.set("response_type", "code");
-    url.searchParams.set("client_id", config.clientId);
-    url.searchParams.set("scope", "openid email profile");
-    url.searchParams.set("redirect_uri", redirectUri);
-    url.searchParams.set("state", state);
-    if (config.teamId) {
-        url.searchParams.set("team", config.teamId);
-    }
-    return url.toString();
-}
-export async function exchangeSlackOidcCode(config, code, redirectUri) {
-    const tokenUrl = `${config.oidcBase}/api/openid.connect.token`;
-    const body = new URLSearchParams({
-        client_id: config.clientId,
-        client_secret: config.clientSecret,
-        code,
-        redirect_uri: redirectUri,
-        grant_type: "authorization_code",
-    });
-    const tokenResponse = await fetchWithTimeout(tokenUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body,
-    }, PROVIDER_HTTP_TIMEOUT_MS);
-    const tokenJson = (await tokenResponse.json());
-    if (!tokenResponse.ok || tokenJson.ok === false || !tokenJson.access_token) {
-        throw new Error(tokenJson.error ?? "Slack OIDC token exchange failed");
-    }
-    const userInfoUrl = `${config.oidcBase}/api/openid.connect.userInfo`;
-    const userResponse = await fetchWithTimeout(userInfoUrl, { headers: { Authorization: `Bearer ${tokenJson.access_token}` } }, PROVIDER_HTTP_TIMEOUT_MS);
-    const userJson = (await userResponse.json());
-    if (!userResponse.ok || userJson.ok === false) {
-        throw new Error(userJson.error ?? "Slack OIDC userInfo failed");
-    }
-    const userId = userJson["https://slack.com/user_id"] ??
-        (typeof userJson.sub === "string"
-            ? userJson.sub.split("|").pop()
-            : undefined);
-    if (!userId) {
-        throw new Error("Slack OIDC userInfo missing user id");
-    }
-    return {
-        userId,
-        ...(userJson["https://slack.com/team_id"]
-            ? { teamId: userJson["https://slack.com/team_id"] }
-            : {}),
-        ...(typeof userJson.email === "string" ? { email: userJson.email } : {}),
-    };
-}
-//# sourceMappingURL=oauth.js.map

package/dist/identity/slack/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD,wCAAwC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAE9C,wDAAwD;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;AAgB1D,MAAM,UAAU,mBAAmB,CACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE;YAChC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,CAAE,CAAC,IAAI,EAAE,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7C,QAAQ,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,CAAC,OAAO,CACvE,KAAK,EACL,EAAE,CACH;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAuB,EACvB,KAAa,EACb,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,2BAA2B,CAAC,CAAC;IACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAuB,EACvB,IAAY,EACZ,WAAmB;IAEnB,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,QAAQ,2BAA2B,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,oBAAoB;KACjC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,QAAQ,EACR;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,EACD,wBAAwB,CACzB,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAK5C,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,kCAAkC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,QAAQ,8BAA8B,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,WAAW,EACX,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,EAClE,wBAAwB,CACzB,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAO1C,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,4BAA4B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GACV,QAAQ,CAAC,2BAA2B,CAAC;QACrC,CAAC,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;YAC/B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YACvC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,2BAA2B,CAAC,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/identity/x/connect-http.d.ts

@@ -1,38 +0,0 @@
-/**
- * Connect-with-X — thin adapter over {@link defineFleetVaultConnect}.
- *
- * Mounted under `/identity/x/*` when listed on `identity.connect`, or inferred
- * from `connectors.x` on a user-scoped deployment. OAuth uses Fleet
- * auth-sessions against the reserved `twitter-oauth-provider` slug (PKCE is
- * handled by Host); there is no local BYO client path.
- */
-import type { FleetVaultConnectProviderOptions } from "../fleet-connect.js";
-export declare const X_CONNECT_STATUS_PATH: string;
-export declare const X_CONNECT_START_PATH: string;
-export declare const X_CONNECT_CALLBACK_PATH: string;
-export declare const X_CONNECT_LINK_PATH: string;
-export declare const isXActorSubjectEnabled: () => boolean;
-export declare const enableXActorSubject: () => void;
-/**
- * Enable actor-subject mode when X connectors imply per-user vault subjects.
- *
- * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
- */
-export declare const enableXActorSubjectFromConnectors: (connectorKinds: readonly (string | undefined)[] | undefined, scope?: import("../connect-provider-types.js").IdentityConnectMountContext["scope"]) => void;
-export declare const resetXActorSubjectEnabledForTests: () => void;
-export declare const isXConnectConfigured: (env?: NodeJS.ProcessEnv) => boolean;
-export declare const xConnectUrl: (publicAppUrl: string) => string;
-/** Options for {@link createXIdentityConnectProvider}. */
-export type XIdentityConnectProviderOptions = Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">;
-/** Build an X connect provider (Fleet auth-sessions / twitter-oauth-provider). */
-export declare const createXIdentityConnectProvider: (options?: Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">) => import("../connect-provider-types.js").IdentityConnectProvider;
-/** Default X connect provider used as a built-in mount candidate. */
-export declare const xIdentityConnectProvider: import("../connect-provider-types.js").IdentityConnectProvider;
-/**
- * Opt into Connect-with-X on `defineIdentity({ connect: […] })`.
- *
- * Usually unnecessary: declaring `connectors.x` on a user-scoped identity
- * deployment mounts this provider and derives OAuth scopes automatically.
- */
-export declare const connect: (options?: Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">) => import("../connect-provider-types.js").IdentityConnectProvider;
-//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/x/connect-http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/x/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAO5E,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AACpD,eAAO,MAAM,oBAAoB,QAAkB,CAAC;AACpD,eAAO,MAAM,uBAAuB,QAAmB,CAAC;AACxD,eAAO,MAAM,mBAAmB,QAAe,CAAC;AAEhD,eAAO,MAAM,sBAAsB,eAA0B,CAAC;AAC9D,eAAO,MAAM,mBAAmB,YAAuB,CAAC;AACxD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,4JACV,CAAC;AACrC,eAAO,MAAM,iCAAiC,YACV,CAAC;AACrC,eAAO,MAAM,oBAAoB,sCAAwB,CAAC;AAC1D,eAAO,MAAM,WAAW,kCAAe,CAAC;AAExC,0DAA0D;AAC1D,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,gCAAgC,EAChC,cAAc,GAAG,QAAQ,GAAG,OAAO,CACpC,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,2JAAmB,CAAC;AAE/D,qEAAqE;AACrE,eAAO,MAAM,wBAAwB,gEAAa,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,OAAO,2JAAY,CAAC"}

package/dist/identity/x/connect-http.js

@@ -1,41 +0,0 @@
-/**
- * Connect-with-X — thin adapter over {@link defineFleetVaultConnect}.
- *
- * Mounted under `/identity/x/*` when listed on `identity.connect`, or inferred
- * from `connectors.x` on a user-scoped deployment. OAuth uses Fleet
- * auth-sessions against the reserved `twitter-oauth-provider` slug (PKCE is
- * handled by Host); there is no local BYO client path.
- */
-import { X_INTEGRATION, readXProviderSlug, } from "../../connectors/toolserver/integrations.js";
-import { defineFleetVaultConnect } from "../define-fleet-connect.js";
-const x = defineFleetVaultConnect({
-    integration: X_INTEGRATION,
-    resolveProviderSlug: readXProviderSlug,
-});
-export const X_CONNECT_STATUS_PATH = x.paths.status;
-export const X_CONNECT_START_PATH = x.paths.connect;
-export const X_CONNECT_CALLBACK_PATH = x.paths.callback;
-export const X_CONNECT_LINK_PATH = x.paths.link;
-export const isXActorSubjectEnabled = x.isActorSubjectEnabled;
-export const enableXActorSubject = x.enableActorSubject;
-/**
- * Enable actor-subject mode when X connectors imply per-user vault subjects.
- *
- * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
- */
-export const enableXActorSubjectFromConnectors = x.enableActorSubjectFromConnectors;
-export const resetXActorSubjectEnabledForTests = x.resetActorSubjectEnabledForTests;
-export const isXConnectConfigured = x.isConnectConfigured;
-export const xConnectUrl = x.connectUrl;
-/** Build an X connect provider (Fleet auth-sessions / twitter-oauth-provider). */
-export const createXIdentityConnectProvider = x.createProvider;
-/** Default X connect provider used as a built-in mount candidate. */
-export const xIdentityConnectProvider = x.provider;
-/**
- * Opt into Connect-with-X on `defineIdentity({ connect: […] })`.
- *
- * Usually unnecessary: declaring `connectors.x` on a user-scoped identity
- * deployment mounts this provider and derives OAuth scopes automatically.
- */
-export const connect = x.connect;
-//# sourceMappingURL=connect-http.js.map

package/dist/identity/x/connect-http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/x/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,MAAM,CAAC,GAAG,uBAAuB,CAAC;IAChC,WAAW,EAAE,aAAa;IAC1B,mBAAmB,EAAE,iBAAiB;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AACpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;AAEhD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC;AACxD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,CAAC,CAAC,gCAAgC,CAAC;AACrC,MAAM,CAAC,MAAM,iCAAiC,GAC5C,CAAC,CAAC,gCAAgC,CAAC;AACrC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC;AAQxC,kFAAkF;AAClF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,cAAc,CAAC;AAE/D,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,QAAQ,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC"}

package/dist/identity/x/index.d.ts

@@ -1,6 +0,0 @@
-/**
- * X identity helpers — Connect-with-X (Fleet vault / twitter-oauth-provider).
- */
-export { connect, createXIdentityConnectProvider, enableXActorSubject, enableXActorSubjectFromConnectors, xConnectUrl, xIdentityConnectProvider, isXActorSubjectEnabled, isXConnectConfigured, resetXActorSubjectEnabledForTests, X_CONNECT_CALLBACK_PATH, X_CONNECT_LINK_PATH, X_CONNECT_START_PATH, X_CONNECT_STATUS_PATH, } from "./connect-http.js";
-export type { XIdentityConnectProviderOptions } from "./connect-http.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/identity/x/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/x/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,8BAA8B,EAC9B,mBAAmB,EACnB,iCAAiC,EACjC,WAAW,EACX,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/identity/x/index.js

@@ -1,5 +0,0 @@
-/**
- * X identity helpers — Connect-with-X (Fleet vault / twitter-oauth-provider).
- */
-export { connect, createXIdentityConnectProvider, enableXActorSubject, enableXActorSubjectFromConnectors, xConnectUrl, xIdentityConnectProvider, isXActorSubjectEnabled, isXConnectConfigured, resetXActorSubjectEnabledForTests, X_CONNECT_CALLBACK_PATH, X_CONNECT_LINK_PATH, X_CONNECT_START_PATH, X_CONNECT_STATUS_PATH, } from "./connect-http.js";
-//# sourceMappingURL=index.js.map

package/dist/identity/x/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/x/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,8BAA8B,EAC9B,mBAAmB,EACnB,iCAAiC,EACjC,WAAW,EACX,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/runtime/credentials.d.ts

@@ -1,68 +0,0 @@
-import type { CredentialTarget, IdentityConfig, ResolvedCredential, RuntimeIdentity } from "../identity/index.js";
-/**
- * Component 5 — Credentials, custom mode.
- *
- * The escape hatch Agent Auth can't cover: bespoke per-caller credential minting
- * via an in-process resolver callback or a hosted token-exchange endpoint. It
- * runs in the worker (not the shared ingress auth handler), applies the output
- * to downstream calls, and caches per `(user, target)` until the credential's
- * `expiresAt`. Secrets live only in this in-memory cache keyed by identity —
- * never in thread state or traces.
- *
- * Managed credential modes (`"user"` / `"agent"`) select toolserver/Connect
- * ownership on the identity axis; only `custom` builds a
- * {@link CredentialsProvider} here.
- */
-/** Env var holding the HMAC secret MDA signs the endpoint assertion with. */
-export declare const CREDENTIAL_SIGNING_SECRET_ENV = "MDA_TOKEN_EXCHANGE_SECRET";
-/** Per-call options for {@link CredentialsProvider.for}. */
-export interface CredentialForOptions {
-    /** Skip the cache and force a fresh mint (e.g. after a downstream 401). */
-    forceRefresh?: boolean;
-}
-/**
- * The per-run credential surface a tool receives as `runtime.credentials`.
- * Tools call `runtime.credentials.for(target)` and attach the returned headers
- * to their downstream request.
- */
-export interface CredentialsProvider {
-    for(target: CredentialTarget, options?: CredentialForOptions): Promise<ResolvedCredential>;
-}
-/**
- * Side effects the executor depends on, injectable so resolution is
- * deterministic under test (no real clock, network, or signing key).
- */
-export interface CredentialDeps {
-    fetch: typeof fetch;
-    now: () => number;
-    /** Signs the assertion MDA presents to a hosted token-exchange endpoint. */
-    signAssertion: (identity: RuntimeIdentity, target: CredentialTarget) => Promise<string>;
-}
-/** Default TTL when a resolver omits `expiresAt` (15 minutes). */
-export declare const DEFAULT_CREDENTIAL_TTL_MS: number;
-/** Soft cap on cached credentials per process. */
-export declare const MAX_CREDENTIAL_CACHE_ENTRIES = 1024;
-/**
- * TTL cache for resolved credentials, keyed by `(user, target)` so
- * per-repo/per-install tokens never collide. Kept out of thread state. Entries
- * expire at the credential's `expiresAt`, or after a default TTL when omitted.
- * The cache is soft-capped to bound memory in long-lived workers.
- */
-export declare class CredentialCache {
-    private readonly defaultTtlMs;
-    private readonly maxEntries;
-    private readonly entries;
-    constructor(defaultTtlMs?: number, maxEntries?: number);
-    get(key: string, nowMs: number): ResolvedCredential | undefined;
-    set(key: string, value: ResolvedCredential, nowMs?: number): void;
-    clear(): void;
-}
-/** Clear the process-level credential cache. Test-only. */
-export declare function clearCredentialCacheForTests(): void;
-/**
- * Build the `runtime.credentials` provider for a run, or `undefined` when the
- * deployment isn't in custom-credentials mode. The provider is bound to the
- * run's resolved identity; every `for(target)` call is scoped to that actor.
- */
-export declare function createCredentialsProvider(cfg: IdentityConfig, identity: RuntimeIdentity | undefined, deps?: Partial<CredentialDeps>, cache?: CredentialCache): CredentialsProvider | undefined;
-//# sourceMappingURL=credentials.d.ts.map